Splunk Search

How to calculate number of days between the beginning of the month to a date within the same month?


Let's say the date is 20th of feb, 2017. I need to calculate the number of days starting from 1st feb, 2017 till 20th feb, 2017 ie 20 days. How can I calculate this?

0 Karma

Super Champion

are the dates you are calculating between values in fields? Are they the range from the time picker?

If they are values in fields, it'd be as simple as |eval daysBetween=round((time2-time1)/86400,0) given that the time fields are in epoch, if not, you'll need to do some more evaling with either strftime

If the values are from the time picker, use

|gentimes start=-1 | addinfo | dedup info_min_time info_max_time 
          | eval daysBetween=round((info_max_time-info_min_time)/86400,2)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!